Privacy Policy

1. Data Controller

The data controller for users of the PKU Zdrowie application is PRZEDSIĘBIORSTWO HANDLOWO-USŁUGOWE Artur Łasocha, based in Poland.

Contact: app@pkuzdrowie.pl

2. What data do we collect?

PKU Zdrowie requires creating an account — either by signing in with Google or with an email address. We collect and process the following data:

Data from your Google account (if you sign in with Google):

• Google account email address
• Name from Google profile (if provided)
• Unique Google account identifier (UID)
• Profile photo from Google account (if provided)

Data from your email account (if you sign in with an email address instead of Google):

• Email address
• Password — stored only in encrypted form by Google's authentication system (Firebase Authentication); the developer has no access to the password in plain text

Data entered by the user (stored locally on device):

• Name and profile data (Phe limit, PKU type, age, weight)
• Meal, meal set and recipe data
• Custom products added by the user
• Blood spot (bibułka) Phe test results (test date, result value, notes)
• Daily diary notes
• Phe calculator history
• Recipe, meal set and meal photos, and profile avatars (saved locally in device storage)

Data stored in Google cloud (always):

• Email, name, UID — for user identification
• Registration date and last login date
• Number of published recipes
• Activity logs (audit logs) — security events such as: sign-in, sign-out, account deletion, recipe publication or deletion, profile deletion, data export and import. Logs contain: user identifier (UID), event type, date and time, app version. Used solely for security purposes and to resolve data-related disputes. Retained for 12 months, after which they are automatically and permanently deleted.

Data stored in Google cloud (optional — depending on features used):

• Community recipes — if the user publishes a recipe: name, ingredients, description, tips, nutritional values, author data (name, UID). Published recipes are publicly visible to all app users.
• Recipe photos — stored in Google cloud storage. Publicly accessible to app users after a recipe is published.
• Sync feature — if the user uses optional data synchronisation between devices: selected data may be synchronised via Google cloud.

Automatically collected data (anonymous analytics):

• In-app events (app launch, navigation)
• Device information (model, Android version)
• Session duration
• Country/region (based on IP address)

Data on Google Drive (only when using the Backup feature):

• Backup file in the "PKU Zdrowie" folder on your Google Drive
• The file contains: profiles, meals, recipes, sets, custom products — in JSON format including photos
• The app has access only to files it has created itself (scope: drive.file)

3. Purpose and legal basis for data processing

We process data on the following legal grounds (GDPR):

• Performance of a contract (Art. 6(1)(b) GDPR) — user authentication, enabling use of app features
• Legitimate interest of the controller (Art. 6(1)(f) GDPR) — technical analysis of app performance (anonymous analytics), security
• Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — processing of health data (Phe limit, PKU type, weight, blood spot test results) and use of optional features requiring cloud data processing. You provide this voluntarily by entering data in the app.

4. App permissions

The app may request the following Android system permissions:

• Internet — required for Google sign-in, cloud synchronisation and Drive backup
• Camera (CAMERA) — optional, for taking recipe photos and profile avatars, and for scanning product barcodes
• Notifications (POST_NOTIFICATIONS) — for optional meal reminders (Android 13+)
• Exact alarms (SCHEDULE_EXACT_ALARM) — for scheduling notifications at a specific time

5. Third-party services

The app uses services provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA): Google Sign-In for authentication, Google cloud services for storing the user profile and published recipes, Google cloud storage for recipe photos, anonymous analytics for improving app quality, and Google Drive for optional backup. Where applicable, optional data synchronisation between devices is also handled via Google cloud. All services operate in accordance with Google's Privacy Policy.

Google Drive — optional backup feature. The app creates and reads only files in the "PKU Zdrowie" folder on the user's account. It has no access to any other files on Drive.

6. International data transfers

We use Google cloud services whose servers may be located outside the European Economic Area (EEA), including in the USA. Data transfers are made on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection in compliance with GDPR.

More information: policies.google.com/privacy

7. Data sharing

We do not sell or share user data with third parties for commercial purposes. Data is shared only with:

• Google LLC — for authentication, account profile storage, Community recipes, optional data synchronisation and technical analytics
• Google LLC — anonymous technical analytics data about app usage
• Google Drive — only when the user activates the Backup feature

The Data Export feature generates a JSON file on the user's device — the user decides who to share this file with and how.

Recipes published in the Community are publicly visible to all app users.

8. How to delete your account and data?

You can permanently delete your account and all associated data directly from within the app:

1. Open the app and go to the Profile tab (bottom navigation bar).
2. Tap Settings (gear icon in the top-right corner).
3. Scroll down and tap "Delete data and sign out".
4. Type DELETE in the confirmation field to confirm.
5. Tap the Delete button — all local data and your account profile on the server will be permanently removed.

9. Third-party libraries and services

The app uses the following libraries:

• Jetpack Compose, Room, DataStore — Google Android
• Google authentication, cloud database, cloud storage, analytics — Google LLC
• Google ML Kit Barcode Scanning — for scanning product barcodes
• Coil — for displaying local photos
• Vico — for displaying statistics charts
• OkHttp — for network communication (Drive backup)

10. Your rights (GDPR)

• Right of access (Art. 15) — all data is visible directly within the app
• Right to erasure (Art. 17) — the "Delete data and sign out" option in the app Settings removes all local data and your account data from the server. See Section 8 for step-by-step instructions. Community recipes are automatically anonymised (author data removed, photos deleted). Activity logs are automatically deleted after 12 months.
• Right to data portability (Art. 20) — use the Data Export or Google Drive Backup feature in Settings
• Right to rectification (Art. 16) — all data can be edited directly within the app
• Right to object (Art. 21) — you may object to processing based on legitimate interest by contacting us at app@pkuzdrowie.pl
• Right to restriction of processing (Art. 18) — contact us at app@pkuzdrowie.pl
• Right to lodge a complaint — you have the right to lodge a complaint with your local supervisory authority. In Poland: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

11. Data security

Local data is stored in a Room database on the device, protected by Android's standard security mechanisms. Only PKU Zdrowie app processes have access to this data.

Data stored in Google cloud is protected with encryption at rest and in transit (TLS). Cloud security rules ensure that each user has access only to their own data.

12. Data retention

Data is retained for the duration of your use of the app. Upon account deletion (the "Delete data and sign out" option), data is immediately removed from the device and from Google's servers. Anonymous analytics data is retained by Google for up to 14 months.

Activity logs (audit logs) — retained for 12 months from the date of the event, after which they are automatically and permanently deleted.

13. Children

PKU Zdrowie is designed for people with phenylketonuria and their caregivers, including children. Google Sign-In requires a Google account — for children under 13, the account should be managed by a parent or legal guardian who consents to the processing of the child's health data.

14. Limitation of liability

PKU Zdrowie is provided "as-is", without any warranties — express or implied — regarding its availability, continuity of service, fitness for a particular purpose, or freedom from errors.

The app developer shall not be liable for:

• data loss resulting from device failure, operating system issues, Google service outages or other factors beyond the developer's control;
• damages arising from use of the app or inability to use it;
• dietary or medical decisions made based on information displayed by the app (see Section 15);
• acts or omissions of third parties, including Google LLC.

The developer reserves the right to modify, restrict or discontinue any feature of the app at any time, without prior notice and without liability to users.

15. Changes to this Privacy Policy

The developer reserves the right to amend this privacy policy at any time. Users will be informed of significant changes through an app update on Google Play and by updating the date at the top of this document. Continued use of the app after changes are published constitutes acceptance of the updated policy.

16. Medical disclaimer

PKU Zdrowie is an assistive tool for diet management and does not constitute medical advice.

Data on phenylalanine content, calories and nutrients is for informational purposes only and is sourced from publicly available nutritional value tables. It may differ from the actual composition of specific products due to differences between batches, manufacturers or preparation methods.

The daily Phe limit and all dietary decisions should be established and supervised by a doctor or qualified dietitian specialising in the treatment of phenylketonuria. The app does not replace medical consultations, laboratory tests or an individual treatment plan.

If you have any concerns about your diet or health, always consult your treating physician.

17. Contact

For privacy-related questions or to exercise your GDPR rights, please contact us:

• 📧 Email: app@pkuzdrowie.pl
• 🕐 Hours: Monday–Friday 9:00–15:00 CET